Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2024 11:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
General
-
Target
14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe
-
Size
1.4MB
-
MD5
789e769ce9e544abee35a62420371d8f
-
SHA1
f1410949763c9386ff07b18e852a02bbeb3d7017
-
SHA256
14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73
-
SHA512
8a16f24eca845840a5213e4ed8c8812d2c09bba7f37e0d42a49788bc98633e8e46cd9cb69e3c9ee2616ff87cfa2fe15c794cd9099e363b2be39ed16184b84a08
-
SSDEEP
24576:HPhKDEa9xALCk5tIx8Eh6cy0UwPEnLW6pJTTnTTXTTgTTkTToTT6TTBTTTuTTWTI:HPva9xALCk5iucWYmW6pJTTnTTXTTgT9
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe -
resource yara_rule behavioral2/memory/1544-1-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral2/memory/1544-3-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral2/memory/1544-4-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral2/memory/1544-6-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral2/memory/1544-9-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral2/memory/1544-8-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral2/memory/1544-5-0x0000000002460000-0x000000000351A000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e578afa 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe File opened for modification C:\Windows\SYSTEM.INI 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe Token: SeDebugPrivilege 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1544 wrote to memory of 780 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe 8 PID 1544 wrote to memory of 788 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe 9 PID 1544 wrote to memory of 64 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe 13 PID 1544 wrote to memory of 2792 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe 49 PID 1544 wrote to memory of 2880 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe 50 PID 1544 wrote to memory of 2260 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe 51 PID 1544 wrote to memory of 3476 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe 56 PID 1544 wrote to memory of 3560 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe 57 PID 1544 wrote to memory of 3772 1544 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe 58 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:64
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2792
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2880
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2260
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe"C:\Users\Admin\AppData\Local\Temp\14670654db9b767632fc57606d44fae7821baa60b85c4d4882784072dc536e73.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1544
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3560
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3772
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5